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What is claimed is: 

1 LA method for securing an access provider, the method comprising: 

2 monitoring communications with at least one access provider for a partially- 

3 completed connection transaction; and 

4 terminating the partially-completed connection transaction when the partially- 

5 completed connection transaction remains in existence for a period of time that exceeds a 

6 threshold period of time. 

1 2, The method as in claim 1, wherein the monitoring comprises: 

2 detecting partially-completed connection transactions initiated by an access requestor; 

3 and 

4 measuring the period of time that a partially-completed connection transaction 

5 remains in existence. 

1 3. The method as in claim 2, wherein the monitoring further comprises 

2 comparing the period of time with the threshold period of time. 



1 4. The method as in claim 1 , wherein the monitoring comprises detecting 

2 partially-completed connection transactions that occur when an access requestor initiates a 

3 connection transaction and the access requestor subsequently fails to send a reply. 

1 5. The method as in claim 4, wherein the monitoring comprises detecting 

2 partially-completed connection transactions that occur when an access requestor initiates a 

3 connection transaction based on a return address that differs from an actual retum address of 

4 the access requestor. 

1 6. The method as in claim 5, wherein the monitoring comprises detecting 

2 partially-completed connection transactions wherein the retum address is an Internet protocol 

3 address that differs from the actual retum address of the access requestor. 

1 7. The method as in claim 1 , wherein the monitoring comprises monitoring 

2 communications with the at least one access provider based on TCP communications for 

3 partially-completed connection transactions. 
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1 8. The method as in claim 7, wherein the monitoring comprises monitoring a 

2 process whereby an access requestor sends a SYN request and the at least one access 

3 provider sends a SYN acknowledgement. 

1 9. The method as in claim 1 , wherein the monitoring comprises monitoring 

2 communications with a plurality of access providers for partially-completed connection 

3 transactions. 

1 10. The method as in claim 1 , wherein the terminating comprises resetting a 

2 communication port located on the at least one access provider. 

1 11. The method as in claim 1 , wherein the threshold period of time is configurable 

2 such that the terminating comprises terminating the partially-completed connection 

3 transaction when the partially-completed connection transaction remains in existence for a 

4 period of time that exceeds a configurable threshold period of time. 

1 12. The method as in claim 2, wherein the access requestor is a client and the 

2 access provider is a host such that the monitoring comprises detecting partially-completed 

3 connection transactions between at least one client and at least one host. 

1 13. The method as in claim 2, wherein the access requestor is a client and the 

2 access provider is a host such that the monitoring comprises detecting partially-completed 

3 connection transactions between at least one client and a plurality of hosts. 

1 14. The method as in claim 2, wherein the access requestor is a client and the 

2 access provider is a host such that the monitoring comprises detecting partially-completed 

3 connection transactions between a plurality of clients and at least one host. 

1 1 5 . A system for securing an access provider, comprising: 

2 means for monitoring communications with at least one access provider for a 

3 partially-completed connection transaction; and 
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4 means for terminating the partially-completed connection transaction when the 

5 partially-completed connection transaction remains in existence for a period of time that 

6 exceeds a threshold period of time. 

1 1 6. The system of claim 15, wherein the means for monitoring comprises: 

2 means for detecting partially-completed connection transactions initiated by an access 

3 requestor; 

4 means for measuring the period of time that a partially-completed connection 

5 transaction remains in existence; and 

6 means for comparing the period of time with the threshold period of time. 

1 1 7. The system of claim 15, wherein the means for monitoring comprises means 

2 for detecting partially-completed connection transactions that occur when an access requestor 

3 initiates a connection transaction and the access requestor subsequently fails to send a reply. 

1 18. The system of claim 1 7, wherein the means for monitoring comprises means 

2 for detecting partially-completed connection transactions that occur when an access requestor 

3 initiates a connection transaction based on a return address that differs from an actual retum 

4 address of the access requestor. 

1 19. The system of claim 15, wherein the means for monitoring comprises means 

2 for monitoring commimications with the at least one access provider based on TCP 

3 communications for partially-completed connection transactions whereby an access requestor 

4 sends a SYN request and the at least one access provider sends a SYN acknowledgement. 

1 20. The system of claim 16, wherein the access requestor is a client and the access 

2 provider is a host such that the means for monitoring comprises means for detecting partially- 

3 completed connection transactions between at least one client and at least one host. 

1 2 1 . A system for securing an access provider, comprising: 

2 a monitoring component that is structured and arranged to monitor communications 

3 with at least one access provider for a partially-completed connection transaction; and 
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4 a terminating component that is structured and arranged to terminate the partially- 

5 completed connection transaction when the partially-completed connection transaction 

6 remains in existence for a period of time that exceeds a threshold period of time. 

1 22. The system of claim 2 1 , wherein the monitoring component comprises: 

2 a detection component that is structured and arranged to detect partially-completed 

3 connection transactions initiated by an access requestor; and 

4 a measuring component that is structured and arranged to measure the period of time 

5 that a partially-completed connection transaction remains in existence. 

1 23. The system of claim 22, wherein the monitoring component further comprises 

2 a comparing component that is structured and arranged to compare the period of time with 

3 the threshold period of time. 

1 24. The system of claim 21, wherein the monitoring component comprises a 

2 detection component that is structured and arranged to detect partially-completed connection 

3 transactions that occur when an access requestor initiates a connection transaction and the 

4 access requestor subsequently fails to send a reply. 

1 25. The system of claim 24, wherein the monitoring component comprises a 

2 detection component that is structiu"ed and arranged to detect partially-completed connection 

3 transactions that occur when an access requestor initiates a connection transaction based on a 

4 return address that differs from an actual return address of the access requestor. 

1 26. The system of claim 25, wherein the monitoring component comprises a 

2 detection component that is structured and arranged to detect partially-completed connection 

3 transactions wherein the return address is an Intemet protocol address that differs from the 

4 actual return address of the access requestor. 

1 27. The system of claim 21, wherein the monitoring component is structured and 

2 arranged to monitor communications with the at least one access provider based on TCP 

3 commimications for partially-completed connection transactions. 
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1 28. The system of claim 27, wherein the monitoring component is structured and 

2 arranged to monitor a process whereby an access requestor sends a SYN request and the at 

3 least one access provider sends a SYN acknowledgement. 

1 29. The system of claim 2 1 , wherein the monitoring component is structured and 

2 arranged to monitor communications with a plurality of access providers for partially- 

3 completed connection transactions. 

1 30. The system of claim 2 1 , wherein the terminating component comprises a reset 

2 component that is structured and arranged to reset a conmiunication port located on the at 

3 least one access provider. 

1 31. The system of claim 2 1 , wherein the threshold period of time is a configurable 

2 threshold period of time. 

1 32. The system of claim 22, wherein the access requestor is a chent and the access 

2 provider is a host such that the monitoring component comprises a detection component that 

3 is structured and arranged to detect partially-completed connection transactions between at 

4 least one client and at least one host. 

1 33. The system of claim 22, wherein the access requestor is a cUent and the access 

2 provider is a host such that the monitoring component comprises a detection component that 

3 is structured and arranged to detect partially-completed connection transactions between at 

4 least one client and a plurality of hosts. 

1 34. The system of claim 22, wherein the access requestor is a client and the access 

2 provider is a host such that the monitoring component comprises a detection component that 

3 is structured and arranged to detect partially-completed connection transactions between a 

4 plurality of clients and at least one host. 
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1 35. The system of claim 21, wherein the monitoring component and the 

2 terminating component are included in a switch that receives commxmications from a host 

3 computer system. 

1 36. The system of claim 2 1 , wherein the monitoring component and the 

2 terminating component are included in a host computer system that receives commimications 

3 from a switch. 
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